PT-2021-14313 · Unknown · Groupsession Zion+2

Tsutomu Aramaki · Published 2021-12-24 · Updated 2022-01-10 · CVE-2021-20875

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: GroupSession Free edition versions 5.1.1 and earlier GroupSession byCloud versions 5.1.1 and earlier GroupSession ZION versions 5.1.1 and earlier

Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks by having a user access a specially crafted URL.

Recommendations: For GroupSession Free edition versions 5.1.1 and earlier, consider restricting access to URLs that could be used for phishing attacks until a patch is available. For GroupSession byCloud versions 5.1.1 and earlier, avoid using URLs that could be exploited for open redirects until the issue is resolved. For GroupSession ZION versions 5.1.1 and earlier, as a temporary workaround, consider disabling access to external URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-20875

Affected Products

Groupsession Free Edition

Groupsession Zion

Groupsession Bycloud

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-20875 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20875 · Vendor Advisory
• https://groupsession.jp/info/info-news/security20211220 · Vendor Advisory
• https://t.me/cvenotify/24874 · Telegram Post
• https://t.me/cibsecurity/34600 · Telegram Post
• https://jvn.jp/en/jp/JVN79798166/index.html · Note